From faa3265e496bcff4e9284b2f38b089c7abf4cfa0 Mon Sep 17 00:00:00 2001 From: Julian Cuni Date: Thu, 3 Sep 2026 12:01:56 +0200 Subject: [PATCH] fix(desktop): restore VITE_API_BASE for the desktop build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit apps/web/.env.production's VITE_API_BASE went empty in 96fd97e to fix the booth/browser same-origin case, but the desktop build shares that file and was never given its own override — login broke with WebKitGTK's "The string did not match the expected pattern." (a relative fetch() URL with no base, from tauri://localhost). beforeBuildCommand now sets VITE_API_BASE=http://127.0.0.1:3000 inline for the desktop build only; verified both builds independently produce the right output. --- apps/desktop/src-tauri/tauri.conf.json | 2 +- wiki/decisions/desktop-shell-tauri.md | 19 +++++++++++++++---- wiki/log.md | 14 ++++++++++++++ 3 files changed, 30 insertions(+), 5 deletions(-) diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json index 0832156..723dfe3 100644 --- a/apps/desktop/src-tauri/tauri.conf.json +++ b/apps/desktop/src-tauri/tauri.conf.json @@ -7,7 +7,7 @@ "devUrl": "http://localhost:5173", "frontendDist": "../../web/dist", "beforeDevCommand": "pnpm --filter @parking/web dev", - "beforeBuildCommand": "pnpm --filter @parking/web build" + "beforeBuildCommand": "VITE_API_BASE=http://127.0.0.1:3000 pnpm --filter @parking/web build" }, "app": { "windows": [ diff --git a/wiki/decisions/desktop-shell-tauri.md b/wiki/decisions/desktop-shell-tauri.md index 7e2e5b8..3f1dae0 100644 --- a/wiki/decisions/desktop-shell-tauri.md +++ b/wiki/decisions/desktop-shell-tauri.md @@ -140,10 +140,21 @@ Per the user's choices — the operator **keeps OS access** (no fullscreen lockd - **Right-click:** the context menu is blocked in **prod only** (`apps/web/src/lib/kiosk.ts`, guarded on `import.meta.env.PROD`); dev keeps right-click + devtools. Applies to both the browser prod build and the desktop build (same SPA). -- **`VITE_API_BASE` wired to the environment:** `apps/web/.env.production` (committed, non-secret, - allow-listed in `.gitignore`) sets `VITE_API_BASE=http://127.0.0.1:3000`, auto-loaded by - `vite build` (which the desktop bundle runs). So the desktop build targets Fastify with no manual - export; the browser-served-by-Fastify build should override to `""`. +- **`VITE_API_BASE` — desktop vs. browser (regression found + fixed 2026-09-03):** + `apps/web/.env.production` (committed, shared by both builds) sets `VITE_API_BASE=` (empty) — this + is correct for the **browser/booth** build (Fastify same-origin, stays relative) since commit + `96fd97e` (2026-06-27), but that same change silently broke the **desktop** build, which was never + given its own override. Result: the desktop shell's `apiUrl()` returned a bare relative path + (`/api/auth/login`) to `fetch()` from a page loaded at `tauri://localhost` — WebKitGTK has no base + to resolve a relative URL against from a non-`http(s)` origin, and threw `DOMException: "The + string did not match the expected pattern."` on the first authenticated request (login). Login + worked fine in the browser (same-origin, no absolute URL needed) the whole time, which is what + made this easy to miss. **Fix:** `tauri.conf.json`'s `build.beforeBuildCommand` now sets + `VITE_API_BASE=http://127.0.0.1:3000` inline (`VITE_API_BASE=http://127.0.0.1:3000 pnpm --filter + @parking/web build`) — process env vars override `.env.production` in Vite's load order, so this + overrides the shared file for the desktop build only, without touching it (the browser/booth build + still gets the empty value, unaffected). Verified: rebuilding with the override bakes + `127.0.0.1:3000` into the bundle; rebuilding without it stays clean/relative. - **Auto-update (prompt-on-update, self-hosted):** `tauri-plugin-updater` + `tauri-plugin-process`. On launch the SPA checks the endpoint (`apps/web/src/lib/desktop-updater.ts`, no-op in browser / offline), prompts the operator (i18n `update.prompt`), then `downloadAndInstall()` + `relaunch()`. diff --git a/wiki/log.md b/wiki/log.md index ae3ff9a..8ae09ec 100644 --- a/wiki/log.md +++ b/wiki/log.md @@ -2740,3 +2740,17 @@ model (booth operator as primary adversary) makes an extractable, hard-to-rotate deployed binary worse than just publishing installers publicly. `release.yml`, `apps/desktop/src-tauri/tauri.conf.json`, `apps/desktop/README.md` updated; full detail on [[desktop-shell-tauri]]. + +## [2026-09-03] fix | Desktop login broken by a VITE_API_BASE regression from the booth same-origin fix + +The 2026-06-27 booth fix (commit 96fd97e) correctly blanked `apps/web/.env.production`'s +`VITE_API_BASE` for the browser/booth same-origin case, but the desktop build shares that same +file and was never given its own override — the desktop shell has been building with an empty +API base since that commit, unnoticed until now. Symptom: login threw `DOMException: "The string +did not match the expected pattern."` — WebKitGTK rejecting a relative `fetch()` URL with no base +to resolve against, since the desktop window's origin is `tauri://localhost`. Browser login was +unaffected (same-origin, no absolute URL needed), which is why this went unnoticed through the CI +mirror-repo debugging session. Fixed by setting `VITE_API_BASE=http://127.0.0.1:3000` inline in +`tauri.conf.json`'s `beforeBuildCommand`, overriding the shared `.env.production` for the desktop +build only (process env wins in Vite's load order) — verified both builds independently. Full +detail on [[desktop-shell-tauri]].